SBoova646688 (Community Member) asked a question.
Why is setting a textbox value to a sessions variable flagged as CWE 80
See below, line 70 is flagged
Dim fName As String = String.Empty
60
Dim lName As String = String.Empty
61
62
If Session("FirstName") IsNot Nothing Then
63
fName = Session("FirstName").ToString()
64
End If
65
66
If Session("LastName") IsNot Nothing Then
67
lName = Session("LastName").ToString()
68
End If
69
70
txtCurrentUser.Text = String.Format("{0} {1}", fname, lName)
71
txtDefaultDate.Text = FormatDateTime(Now, DateFormat.ShortDate)
72
getUserInfoFromDB()
.png){kind=logo}
Hi @SBoova646688 (Community Member) ,
Veracode Static Analysis reports flaws of CWE 80 when it can see data from a potentially untrusted source (such as a HTTP request, but also a file, database result or session) going into a Label.Text property.
The concern is that if an attacker can insert HTML into this data they will be able to display this on your web pages causing an XSS or Cross-Site-Scripting vulnerability ( https://en.wikipedia.org/wiki/Cross-site_scripting ).
We recommend using one of our supported cleansing functions from our list at https://help.veracode.com/r/review_cleansers to HTML encode any data going into a .Text property.
Veracode Static Analysis will be able to automatically recognize it's use (if used appropriately) and will automatically close this flaw upon making the change, rebuilding and resubmitting for analysis.
For example by replacing line 70 with:
txtCurrentUser.Text = Server.HtmlEncode(String.Format("{0} {1}", fname, lName))
Thank you,
Boy Baukema